AZL-34860 CVE-2022-2785 affecting package kernel for versions less than 6.6.35.1-4

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

Design/Logic Flaw

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpfsysbpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAPBPF can arbitrarily read memory from anywhere on the system. We...

PT-2022-24193 · WordPress · Read More By Adam

Name of the Vulnerable Software and Affected Versions: Read more By Adam plugin version 1.1.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Read more By Adam plugin at WordPress, allowing unauthorized actions to be performed on behalf of a user without their...

PT-2022-21799 · Apache · Apache Pulsar Broker/Proxy

Name of the Vulnerable Software and Affected Versions: Apache Pulsar Broker and Proxy versions 2.6.4 and earlier Apache Pulsar Broker and Proxy versions 2.7.0 through 2.7.4 Apache Pulsar Broker and Proxy versions 2.8.0 through 2.8.3 Apache Pulsar Broker and Proxy versions 2.9.0 through 2.9.2 Apac...

PT-2022-25234 · WordPress · Seriously Simple Podcasting

Name of the Vulnerable Software and Affected Versions: Seriously Simple Podcasting plugin versions prior to 2.16.0 Description: A Cross-Site Request Forgery CSRF issue allows for changes to plugin settings. Recommendations: For versions prior to 2.16.0, update to version 2.16.0 or later to resolv...

PT-2022-24538 · WordPress · Seo Redirection

Name of the Vulnerable Software and Affected Versions: SEO Redirection plugin versions = 8.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which can lead to the deletion of 404 errors and redirection history. Recommendations: For SEO Redirection plugin versions = 8.9,...

PT-2022-25217 · Unknown · Online Banking System

Name of the Vulnerable Software and Affected Versions: Online Banking System version 1.0 Description: A SQL injection issue was found in the Online Banking System. The vulnerability can be exploited via the cust id parameter at the "/net-banking/edit customer.php" API endpoint. Recommendations: F...

PT-2022-25210 · Tenda · Tenda I9

Name of the Vulnerable Software and Affected Versions: Tenda i9 version 1.0.0.83828 Description: A buffer overflow issue was discovered, allowing attackers to cause a Denial of Service DoS via a crafted string. The issue is related to the formexeCommand function. Recommendations: For Tenda i9...

PT-2022-25286 · WordPress · Testimonial Slider

Name of the Vulnerable Software and Affected Versions: GS Testimonial Slider plugin versions prior to 1.9.7 Description: The issue concerns multiple authenticated Stored Cross-Site Scripting XSS vulnerabilities. This means that an attacker with contributor or higher privileges can inject maliciou...

Upgraded Q -> M from 143 [1663859521800]

Judge has assessed an item in Issue 143 as Medium risk. The relevant finding follows: 2.ETHRegistrarController.register can pass any "resolver" and "data" parameters , then ETHRegistrarController do "functionCall " It is possible to pass malicious parameters example : resolver =...

PT-2022-25389 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: A full path disclosure issue was discovered in ZZCMS 2022. This issue can be exploited via the "/admin/index.PHP? server" API endpoint. Recommendations: For ZZCMS version 2022, consider restricting access to th...

PT-2022-22512 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A segmentation violation was discovered in OTFCC commit 617837b via the /release-x64/otfccdump+0x6b6a8f endpoint. Recommendations: For OTFCC commit 617837b, consider avoiding the use of the...

PT-2022-21433 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.6 Description: The issue is related to Cross-Site Request Forgery CSRF in the repository settings. A malicious user can change the settings of a repository by sending a URL to the victim. Recommendations: For...

PT-2022-24497 · Apache +5 · Apache Xml Graphics Batik +5

Name of the Vulnerable Software and Affected Versions: Apache XML Graphics Batik version 1.14 Description: A Server-Side Request Forgery SSRF issue allows an attacker to fetch external resources. This can be exploited by an attacker to access resources that should not be accessible...

PT-2022-25388 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: An absolute path traversal issue allows attackers to obtain sensitive information via a crafted GET request sent to "/one/siteinfo.php". Recommendations: For ZZCMS version 2022, as a temporary workaround,...

PT-2022-21232 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.6 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository ikus060/rdiffweb. This could potentially lead to disabling notifications in a user's profile. Recommendations: For...

PT-2022-6741 · Nlnet +8 · Unbound +8

Name of the Vulnerable Software and Affected Versions: Unbound versions prior to 1.16.3 Description: The issue is related to a Non-Responsive Delegation Attack NRDelegation Attack that affects various DNS resolving software, including Unbound. This attack involves a malicious delegation with a...

PT-2022-24833 · Netlify · Netlify-Ipx

Name of the Vulnerable Software and Affected Versions: netlify-ipx versions prior to 1.2.3 Description: The issue allows an attacker to bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is...

PT-2022-23761 · Ahsay · Ahsaycbs

Name of the Vulnerable Software and Affected Versions: Ahsay AhsayCBS version 9.1.4.0 Description: The issue allows an authenticated system user to inject arbitrary Java JVM options. Administrators with the ability to modify the Runtime Options in the web interface can inject Java Runtime Options...

PT-2022-25750 · Jenkins · Jenkins Rundeck Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Rundeck Plugin versions 3.6.11 and earlier Description: The issue allows users with Overall/Read permission to trigger jobs configured to be triggerable via Rundeck, due to inadequate protection of access to the...